- restored the security check of referer for access to countrystate request so it only comes from the origin